{"id":9456,"date":"2026-09-11T10:15:00","date_gmt":"2026-09-11T10:15:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9456"},"modified":"2026-09-11T10:15:00","modified_gmt":"2026-09-11T10:15:00","slug":"how-ai-and-cybersecurity-are-reshaping-servicenow","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9456","title":{"rendered":"How AI and cybersecurity are reshaping ServiceNow"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

The once stable era of IT service management (ITSM) has entered a period of disruption and uncertainty. At least if you\u2019re an investor or enterprise customer with an interest in ITSM giant ServiceNow, the signals over recent months have been hard to ignore.<\/p>\n

Last year, the category leader delivered market-pleasing AI announcements, a record share price, and good quarterly revenue growth, as well as an interesting pivot toward cybersecurity with the December acquisition of partner Armis for $7.75 billion<\/a> in cash.<\/p>\n

But as the calendar turned to 2026, the phrase \u201cSaas apocalypse\u201d started to gain traction, and market sentiment about SaaS incumbents suddenly melted away, causing ServiceNow\u2019s share price to drop 30% by mid-2026, albeit from historic highs.<\/p>\n

What\u2019s driving anxiety is the perception that AI agents and vibe-coding tools will soon took over many of the previously complex workflow, automation, and software tasks carried out traditionally by subscription platforms, including ServiceNow\u2019s. Customers will stop buying SaaS subscriptions because they won\u2019t need employees or \u201cseats\u201d to do this work. Instead, cheaper internal AI tools, or larger cloud platforms doing the same job, will simply automate the market away.<\/p>\n

While some enterprise IT leaders are in fact empowering business users to vibe code<\/a> their own solutions, the model for replacing vendors with vibe-coded apps remains edgy business<\/a>. As a result, SaaS isn\u2019t likely dying any more than on-premises software, though CIOs are still reimagining software\u2019s future as AI agents advance<\/a>.<\/p>\n

So too is ServiceNow, including how it expects IT leaders to finance that future. The company\u2019s June Financial Analyst Day 2026 presentation<\/a> confirmed a shift away from subscriptions based on seats is already under way, with only 50% of the company\u2019s Net New Annual Contract Value (SaaS jargon for new revenue) in 2025 coming from this source. Instead, growth is increasingly generated by \u201cconsumed\u201d services such as infrastructure, integrations and connectors, AI token consumption, and cybersecurity.<\/p>\n

AI convergence<\/h2>\n

AI is causing previously distinct sectors such as ITSM and cybersecurity to converge, with AI itself turning into a unifying AIOps<\/a> front end to diverse, specialized technologies sitting below it. In this, ServiceNow looks well-placed, having added the Virtual Agent chatbot system to its Now platform as long ago as 2018, later reinforced by acquisitions, including search outfit Element AI, chatbot company Passage AI, and AIOps pioneer Loom Systems. In 2025, this evolution crystalized as the ServiceNow AI Platform<\/a>, a rebranded Now platform augmented by unifying features such as the AI Control Tower.<\/p>\n

In traditional ITSM, the platform helps teams build workflows without the need for coding in a way that simplifies complex processes. AI takes this a step further; now it becomes possible not only to generate a workflow but reason and act on it. In this, AI and ITSM look like a natural combination as each enhances the usefulness of the other.<\/p>\n

But building a better AI front end or adding automation to workflows gets you only so far, which makes the company\u2019s Armis acquisition, its largest ever, intriguing. Unlike previous ServiceNow acquisitions with a cybersecurity theme \u2014 Veza in 2025<\/a>, Mission Secure in 2024 \u2014 Armis\u2019s agentless platform is more than an information gathering system. It can also orchestrate actions such as isolation and blocking across a wide range of devices, including workstations, routers, switches, firewalls, and the long tail of often forgotten medical scanners and IoT devices.<\/p>\n

Nevertheless, it is the ability to build an accurate inventory that explains why the acquisition happened at an eye-watering 23 times annual revenue, says Brad LaPorte<\/a>, a former Gartner analyst who now works with Lionfish Tech Advisors. ServiceNow didn\u2019t buy Armis to sell it as a cybersecurity sideline because its $340 million annual revenue and annual growth rate are too small to justify that.<\/p>\n

\u201cNobody pays 23 times revenue for a product. They pay for a position. That single financial fact explains most of what customers are about to experience, good and bad,\u201d says LaPorte. The limitation of today\u2019s ITSM and configuration management database (CMDB)<\/a> systems is that workflows assume the CMDB is accurate when it\u2019s often a work of fiction<\/a>.<\/p>\n

\u201cEveryone reconciles to it. Nobody believes it. Every attack surface tool on the market can tell you what it found. Not one of them can tell you who is going to fix it by Friday,\u201d LaPorte says.<\/p>\n

So, buying Armis is less about adding cybersecurity than supercharging the company\u2019s traditional ITSM workflows, which have recently been given an AI makeover. At the same time, by making its platform appealing to hospitals, utilities, and manufacturing, ServiceNow can attract customers in completely new sectors.<\/p>\n

According to LaPorte, ServiceNow customers should be alert to the ways this changes their relationship. Customers are likely to experience Armis being heavily marketed to them at contract renewal. In theory, this is good, assuming they can refuse. But they might find that the financial engineering and incentives behind this could be complex to untangle and don\u2019t always work in their favor over the contract period.<\/p>\n

Armis will also bring ServiceNow into competition with a new set of rivals, LaPorte notes, and bring into the fold a new buyer, the CISO, it has never previously had to win over. CISOs are skeptical by nature as well as sensitive to the occasional security weaknesses that have affected ServiceNow itself<\/a>.<\/p>\n

\u201cArmis was Switzerland. It integrated with everybody, including every ITSM platform that competes with ServiceNow. That neutrality was part of the product,\u201d LaPorte says. \u201cThat is gone now. This just moved everybody\u2019s negotiating position.\u201d<\/p>\n

Consumption pricing<\/h2>\n

Several experts spoken to for this article agreed that the SaaS apocalypse idea is overblown in relation to ServiceNow. Its incumbency protects it from AI because reproducing ServiceNow\u2019s capabilities using vibe-coded AI could prove more challenging than people assume. However, there is consensus that the convergence of AIOps and cybersecurity will be highly disruptive in the ITSM sector.<\/p>\n

\u201cServiceNow is competing with Microsoft, which can bundle, and with the model vendors, who are climbing up into the application layer,\u201d argues Lionfish Tech Advisors CEO Rob Smith<\/a>, another ex-Gartner analyst. \u201cServiceNow\u2019s defense is not that it has a better model, which it doesn\u2019t. Its defense is that it knows the steps in your process, and that is expensive to re-create.\u201d<\/p>\n

Chris Selland<\/a>, founder of research company Differential Factor, who lectures at Northeastern University on entrepreneurship and disruption (and has written on SaaS<\/a> for CIO.com), agrees that ServiceNow\u2019s Armis acquisition looks like an important piece of a puzzle.<\/p>\n

\u201cThe Armis deal extends that map into everything that was never in the CMDB, such as IoT and medical devices. It\u2019s a defense of their asset graph,\u201d he says. And the company probably sees itself as having something to defend. \u201cServiceNow is in around 90% of the Fortune 500, so yes this is fundamentally a \u2018sell more to the base\u2019 strategy,\u201d argues Selland.<\/p>\n

\u201cThe threat was never that AI writes competing enterprise software; it\u2019s seat compression and the collapse of per-seat pricing. That threatens the SaaS industry\u2019s core revenue model,\u201d Selland contends.<\/p>\n

ServiceNow understands this, which is why it is moving toward a consumption-based model. The question is how this will change the balance of power with customers at a time when open-source and open-weight models are driving down AI pricing and competition is fierce, including from large cloud platforms.<\/p>\n

With more players competing for business against specialists such as ServiceNow, this could give buyers a lot more leverage if they understand how to manage hidden cost traps.<\/p>\n

\u201cConsumption-based pricing is much better for both buyers and sellers than seat-based pricing, although it can lead to nasty surprises for buyers if they\u2019re not careful about monitoring what their employees are doing,\u201d Selland says.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

The once stable era of IT service management (ITSM) has entered a period of disruption and uncertainty. At least if you\u2019re an investor or enterprise customer with an interest in ITSM giant ServiceNow, the signals over recent months have been hard to ignore. Last year, the category leader delivered market-pleasing AI announcements, a record share […]<\/p>\n","protected":false},"author":0,"featured_media":9457,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9456","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9456"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9456"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9456\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9457"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9456"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9456"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9456"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}